Azure landing zones in Terraform, with the firewall in the hub.

Yes. Microsoft's Cloud Adoption Framework traditional-networking-topology guidance says, in its design recommendations: deploy Azure Firewall or partner NVAs in the central-hub virtual network for east/west or south/north traffic protection and filtering. Enforza is a partner network virtual appliance, so putting it in the hub is an in-pattern substitution, not a workaround.

Two routes. One, three from-scratch Terraform patterns that build the whole Azure network (a VNet, a public subnet for the gateways and two private workload subnets, plus a network security group) and place the Enforza gateway in it: a simple single-AZ pattern for dev, test and small production; an HA multi-AZ pattern with two gateways across availability zones behind an internal load balancer; and an HA multi-AZ with DNAT pattern that adds an internet-facing load balancer with a DNS name for published services. Two, a single-appliance deploy into a hub you already run, one-click from the Azure Marketplace or via the ARM template. Every gateway registers itself on first boot, then you attach policy in the console.

Each gateway VM registers itself on first boot with a deployment key from the console, and a key is one-time use per firewall. The two HA patterns build two gateway VMs, so they take two different keys, one per gateway. Reusing a single key across both would fail to register the second. The simple single-AZ pattern and the single-appliance Marketplace or ARM route each take one key.

With a user-defined route. In the single-AZ and drop-in appliance routes you point each workload subnet's 0.0.0.0/0 at the firewall's private IP as a virtual appliance. In the HA patterns the Terraform builds the route table for you and points 0.0.0.0/0 at the internal load balancer's private IP (10.0.1.100), which spreads traffic across both gateways. Register or claim each gateway in the console, then attach policy.

On the core egress job, up to 60–80%. A two-network hub-and-spoke pushing 20 TB a month through one Azure Firewall Standard is about $1,232.50/month ($912.50 in deployment-hours at $1.25/hour plus $320 in data-processing at $0.016/GB). The same workload on Enforza is a flat $239 licence (£179) plus the VM you run it on, near $339/month all-in, roughly 72% less. Rates are US list, dated 2026-07-04, directional. Azure self-SNATs, so there is no separate NAT gateway stacked behind it. The full line-by-line maths is on the worked example.

Yes. Three real, validated Terraform patterns that build the network from scratch, not just an appliance dropped into an existing hub: simple single-AZ (one gateway, for dev, test and small deployments), HA multi-AZ (two gateways across availability zones behind an internal load balancer, with route tables sending private-subnet traffic through them), and HA multi-AZ with DNAT (the same plus an internet-facing load balancer with a DNS name, for inbound published services). Each is Terraform, validated clean, and downloadable from the public repository.

Yes. Since 31 March 2026 Azure has retired default outbound access for new deployments, so every workload needs an explicit, deliberate egress path. Enforza as the hub NVA is exactly that: a controlled, filtered, secure-NAT outbound path with audit-ready logs to your own SIEM, rather than an implicit default route.